Merge remote-tracking branch 'origin/master' into zobel-salsa

diff --git a/hieradata/common.yaml b/hieradata/common.yaml
index c7332db..eae4051 100644 (file)
--- a/hieradata/common.yaml
+++ b/hieradata/common.yaml
@@ -190,6 +190,7 @@ roles:
     - dummy
   static_source:
     - boott.debian.org
+    - casulana.debian.org
     - coccia.debian.org
     - dillon.debian.org
     - donizetti.debian.org
@@ -316,10 +317,6 @@ roles:
     - porta.debian.org
   onionbalance:
     - olin.debian.org
-  experimental_apache:
-    - cgi-grnet-01.debian.org
-    - pejacevic.debian.org
-    - petrova.debian.org
   bgp:
     - mirror-bytemark.debian.org
     - mirror-conova.debian.org
@@ -355,3 +352,9 @@ roles:
     - storace.debian.org
   debconf_wafer:
     - debussy.debian.org
+  apache_not_public:
+    # Hosts that run apache but where it should not be open to the internet by
+    # default
+    - casulana.debian.org
+  cdbuilder_local_mirror:
+    - casulana.debian.org

diff --git a/modules/apache2/manifests/init.pp b/modules/apache2/manifests/init.pp
index 985620f..8aacde9 100644 (file)
--- a/modules/apache2/manifests/init.pp
+++ b/modules/apache2/manifests/init.pp
@@ -153,21 +153,23 @@ class apache2 {
                ensure => installed,
        }
 
-       if $::hostname in [beach,buxtehude,picconi,pkgmirror-csail] {
-               include apache2::dynamic
-       } else {
-               @ferm::rule { 'dsa-http':
-                       prio        => '23',
-                       description => 'Allow web access',
-                       rule        => '&SERVICE(tcp, (http https))'
+       if (! has_role('apache_not_public')) {
+               if $::hostname in [beach,buxtehude,picconi,pkgmirror-csail] {
+                       include apache2::dynamic
+               } else {
+                       @ferm::rule { 'dsa-http':
+                               prio        => '23',
+                               description => 'Allow web access',
+                               rule        => '&SERVICE(tcp, (http https))'
+                       }
                }
-       }
 
-       @ferm::rule { 'dsa-http-v6':
-               domain          => '(ip6)',
-               prio            => '23',
-               description     => 'Allow web access',
-               rule            => '&SERVICE(tcp, (http https))'
+               @ferm::rule { 'dsa-http-v6':
+                       domain          => '(ip6)',
+                       prio            => '23',
+                       description     => 'Allow web access',
+                       rule            => '&SERVICE(tcp, (http https))'
+               }
        }
 
        exec { 'service apache2 reload':

diff --git a/modules/debian_org/manifests/apt.pp b/modules/debian_org/manifests/apt.pp
index 48b617e..3fc0979 100644 (file)
--- a/modules/debian_org/manifests/apt.pp
+++ b/modules/debian_org/manifests/apt.pp
@@ -41,11 +41,7 @@ class debian_org::apt {
                }
        }
 
-       if has_role('experimental_apache') {
-               $dbdosuites = [ 'debian-all', $::lsbdistcodename, 'jessie-apache2' ]
-       } else {
-               $dbdosuites = [ 'debian-all', $::lsbdistcodename ]
-       }
+       $dbdosuites = [ 'debian-all', $::lsbdistcodename ]
        site::aptrepo { 'db.debian.org':
                url        => 'http://db.debian.org/debian-admin',
                suite      => $dbdosuites,

diff --git a/modules/grub/templates/puppet-kernel-serial.cfg.erb b/modules/grub/templates/puppet-kernel-serial.cfg.erb
index 0bd187c..d87090f 100644 (file)
--- a/modules/grub/templates/puppet-kernel-serial.cfg.erb
+++ b/modules/grub/templates/puppet-kernel-serial.cfg.erb
@@ -4,7 +4,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX console=ttyAMA0,115200n8"
 GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX console=ttyS0,115200"
 <%- elsif %w{conova-node01 conova-node02}.include?(@hostname) then -%>
 GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX console=ttyS0,115200 earlycon"
-<%- elsif %w{storace fasolo klecker clementi czerny}.include?(@hostname) then -%>
+<%- elsif %w{storace fasolo klecker clementi czerny casulana}.include?(@hostname) then -%>
 GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX console=tty0 console=ttyS1,115200n8"
 <% else -%>
 GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX console=tty0 console=ttyS0,115200n8"

diff --git a/modules/roles/manifests/cdbuilder_local_mirror.pp b/modules/roles/manifests/cdbuilder_local_mirror.pp
new file mode 100644 (file)
index 0000000..9e9cc57
--- /dev/null
+++ b/modules/roles/manifests/cdbuilder_local_mirror.pp
@@ -0,0 +1,21 @@
+class roles::cdbuilder_local_mirror {
+       include apache2
+
+       $apache_addr = "172.29.103.1"
+       $vhost_listen = "${apache_addr}:80"
+
+       apache2::site { '010-local-mirror.cdbuilder.debian.org':
+               site   => 'local-mirror.cdbuilder.debian.org',
+               content => template('roles/apache-local-mirror.cdbuilder.debian.org.erb'),
+       }
+
+       file { "/etc/apache2/ports.conf":
+               require => Package['apache2'],
+               content  => @("EOF"),
+                               # This file is maintained by puppet
+                               Listen 127.0.0.1:80
+                               Listen $vhost_listen
+                               | EOF
+               notify  => Service['apache2']
+       }
+}

diff --git a/modules/roles/manifests/init.pp b/modules/roles/manifests/init.pp
index e447ebb..2172cd2 100644 (file)
--- a/modules/roles/manifests/init.pp
+++ b/modules/roles/manifests/init.pp
@@ -370,4 +370,8 @@ class roles {
        if has_role('debconf_wafer') {
                include roles::debconf_wafer
        }
+
+       if has_role('cdbuilder_local_mirror') {
+               include roles::cdbuilder_local_mirror
+       }
 }

diff --git a/modules/roles/manifests/static_mirror.pp b/modules/roles/manifests/static_mirror.pp
index c95d062..c3d62e5 100644 (file)
--- a/modules/roles/manifests/static_mirror.pp
+++ b/modules/roles/manifests/static_mirror.pp
@@ -96,6 +96,7 @@ class roles::static_mirror {
        ssl::service { 'backports.debian.org'          : ensure => "ifstatic", notify  => Exec['service apache2 reload'], key => true, }
        ssl::service { 'bits.debian.org'               : ensure => "ifstatic", notify  => Exec['service apache2 reload'], key => true, }
        ssl::service { 'blends.debian.org'             : ensure => "ifstatic", notify  => Exec['service apache2 reload'], key => true, }
+       ssl::service { 'cdbuilder-logs.debian.org'     : ensure => "ifstatic", notify  => Exec['service apache2 reload'], key => true }
        ssl::service { 'd-i.debian.org'                : ensure => "ifstatic", notify  => Exec['service apache2 reload'], key => true }
        ssl::service { 'deb.debian.org'                : ensure => "ifstatic", notify  => Exec['service apache2 reload'], key => true }
        ssl::service { 'dpl.debian.org'                : ensure => "ifstatic", notify  => Exec['service apache2 reload'], key => true }
@@ -160,6 +161,7 @@ class roles::static_mirror {
                onion::service { 'backports.debian.org'          : ensure => "ifstatic", port => 80, target_port => 80, target_address => $onion_v4_addr }
                onion::service { 'bits.debian.org'               : ensure => "ifstatic", port => 80, target_port => 80, target_address => $onion_v4_addr }
                onion::service { 'blends.debian.org'             : ensure => "ifstatic", port => 80, target_port => 80, target_address => $onion_v4_addr }
+               onion::service { 'cdbuilder-logs.debian.org'     : ensure => "ifstatic", port => 80, target_port => 80, target_address => $onion_v4_addr }
                onion::service { 'incoming.debian.org'           : ensure => "ifstatic", port => 80, target_port => 80, target_address => $onion_v4_addr }
                onion::service { 'incoming.ports.debian.org'     : ensure => "ifstatic", port => 80, target_port => 80, target_address => $onion_v4_addr }
                onion::service { 'lintian.debian.org'            : ensure => "ifstatic", port => 80, target_port => 80, target_address => $onion_v4_addr }

diff --git a/modules/roles/misc/static-components.yaml b/modules/roles/misc/static-components.yaml
index 493c07c..f1d3535 100644 (file)
--- a/modules/roles/misc/static-components.yaml
+++ b/modules/roles/misc/static-components.yaml
@@ -103,6 +103,9 @@ components:
     master: dillon.debian.org
     source: wuiet.debian.org:/srv/buildd.debian.org/ftp-archive/archive
     limit-mirrors: [ 'klecker.debian.org', 'senfter.debian.org' ]
+  cdbuilder-logs.debian.org:
+    master: dillon.debian.org
+    source: casulana.debian.org:/srv/cdbuilder.debian.org/dst/deb-cd/log
   10years.debconf.org   : { master: 'dillon.debian.org', source: 'dillon.debian.org:/srv/debconf-webpages/web/10years.debconf.org' }
   debconf0.debconf.org  : { master: 'dillon.debian.org', source: 'dillon.debian.org:/srv/debconf-webpages/web/debconf0.debconf.org' }
   debconf1.debconf.org  : { master: 'dillon.debian.org', source: 'dillon.debian.org:/srv/debconf-webpages/web/debconf1.debconf.org' }

diff --git a/modules/roles/templates/apache-local-mirror.cdbuilder.debian.org.erb b/modules/roles/templates/apache-local-mirror.cdbuilder.debian.org.erb
new file mode 100644 (file)
index 0000000..8ae527c
--- /dev/null
+++ b/modules/roles/templates/apache-local-mirror.cdbuilder.debian.org.erb
@@ -0,0 +1,27 @@
+##
+## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
+## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
+##
+
+<VirtualHost <%= @vhost_listen %>>
+       ServerAdmin debian-admin@debian.org
+       ServerName local-mirror.cdbuilder.debian.org
+       ServerAlias security.debian.org
+       ServerAlias deb.debian.org
+       AddCharset UTF-8 .txt
+
+       ErrorLog /var/log/apache2/local-mirror.cdbuilder.debian.org-error.log
+       CustomLog /var/log/apache2/local-mirror.cdbuilder.debian.org-access.log privacy
+
+       Use ftp-archive /srv/mirrors/debian
+       Alias /debian/ /srv/mirrors/debian/
+
+       Use ftp-archive /srv/mirrors/debian-security
+       Alias /debian-security/ /srv/mirrors/debian-security/
+
+       <IfModule mod_userdir.c>
+               UserDir disabled
+       </IfModule>
+</VirtualHost>
+
+# vim:set syn=apache:

diff --git a/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb b/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb
index 43dcd65..cbdeb36 100644 (file)
--- a/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb
+++ b/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb
@@ -213,6 +213,7 @@ vhost(lines, "mirror-master.debian.org"      , :ssl => true)
 vhost(lines, "onion.debian.org"              , :ssl => true)
 vhost(lines, "manpages.debian.org"           , :ssl => true, :extra => true)
 vhost(lines, "planet.debian.net")
+vhost(lines, "cdbuilder-logs.debian.org"     , :ssl => true)
 
 vhost(lines, "bits.debian.org"               , :ssl => true, :extra => true)
 vhost(lines, "micronews.debian.org"          , :ssl => true)

diff --git a/modules/sudo/files/sudoers b/modules/sudo/files/sudoers
index 97852c5..cb64051 100644 (file)
--- a/modules/sudo/files/sudoers
+++ b/modules/sudo/files/sudoers
@@ -189,6 +189,7 @@ buildd              ALL=(ALL)               NOPASSWD: ALL
 %backports     FTPHOSTS,coccia=(staticsync)    NOPASSWD: /usr/local/bin/static-update-component backports.debian.org
 %bootstrap     boott=(staticsync)              NOPASSWD: /usr/local/bin/static-update-component bootstrap.debian.net
 d-i            dillon=(staticsync)             NOPASSWD: /usr/local/bin/static-update-component d-i.debian.org
+debian-cd      casulana=(staticsync)           NOPASSWD: /usr/local/bin/static-update-component cdbuilder-logs.debian.org
 lucas          dillon=(staticsync)             NOPASSWD: /usr/local/bin/static-update-component debaday.debian.net
 dsa            dillon=(staticsync)             NOPASSWD: /usr/local/bin/static-update-component dsa.debian.org
 dak            FTPHOSTS=(staticsync)           NOPASSWD: /usr/local/bin/static-update-component incoming.debian.org